Executive brief
A vulnerability was identified in the Linux kernel's Xilinx CAN network driver, which manages communication for industrial and automotive hardware. A flaw in how the driver handles network data packets could allow a local attacker to cause a system crash or potentially execute unauthorized code. This issue affects systems using Xilinx CAN controllers and has been addressed in recent kernel updates.
Technical details
A use-after-free (UAF) vulnerability exists in the xcan_write_frame() function of the Xilinx CAN driver. The root cause is an incorrect sequence of operations where can_put_echo_skb() is called before the driver has finished accessing the socket buffer (SKB). Since can_put_echo_skb() transfers ownership of the SKB, it may be freed while the driver still holds a reference to it. An attacker with local access could exploit this race condition to trigger memory corruption. The fix involves reordering the function calls to ensure can_put_echo_skb() is only invoked after all driver operations on the SKB are complete. Patches are available for multiple stable kernel branches including 5.15, 6.1, 6.6, and 6.12.
Affected products
- Linux Linux Kernel 4.19 to 5.15.194, 6.1.153, 6.6.107, 6.12.48, 6.16.8
Timeline
- 2025-08-22: patched: Initial patch submitted by Anssi Hannula
- 2025-09-23: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1139321161a3ba5e45e61e0738b37f42f20bc57a
- https://git.kernel.org/stable/c/668cc1e3bb21101d074e430de1b7ba8fd10189e7
- https://git.kernel.org/stable/c/725b33deebd6e4c96fe7893f384510a54258f28f
- https://git.kernel.org/stable/c/94b050726288a56a6b8ff55aa641f2fedbd3b44c
- https://git.kernel.org/stable/c/e202ffd9e54538ef67ec301ebd6d9da4823466c9
- https://git.kernel.org/stable/c/ef79f00be72bd81d2e1e6f060d83cf7e425deee4
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html